Attackers used trusted tools and legitimate-looking workflows in two notable H1 2026 attack chains. One campaign sent malware through compromised business email accounts, while another redirected cryptocurrency payments by replacing copied wallet addresses.
The campaigns used different malware and infrastructure. However, both relied on the same weakness: users trusted actions that appeared normal before attackers quietly altered what happened next.
Compromised Mailboxes Delivered Banking Malware
The first campaign targeted people in Czechia, Slovakia, Poland and Lithuania. Attackers used shipment notifications, invoice messages and scanned-document lures to persuade recipients to open malicious attachments.
Several emails came from compromised corporate mailboxes. This made the messages more convincing because they were sent through real business accounts with established sender histories.
As a result, standard email protections could offer limited help. SPF and DKIM checks may still pass when attackers send messages through an account’s authorised infrastructure. Reputation systems may also treat the sender as legitimate.
After a victim opened the attachment, a JavaScript dropper began the infection chain. It launched several PowerShell stages before delivering shellcode and banking malware linked to GepyS.
The malware then modified proxy settings and installed a browser extension. These changes placed the attackers closer to the victim’s online banking activity.
The full chain moved from a compromised mailbox to a JavaScript dropper, PowerShell stages, a shellcode loader, and finally proxy and browser manipulation.
Malware Stages Slowed Down Analysis
One third-stage payload used a 32-bit position-independent loader designed to complicate static analysis. Researchers found junk MMX and SSE instructions, jumps into the middle of instructions, and a decryption routine using an LFSR-generated keystream and XOR operations.
None of these methods was new. Still, combining them made fast analysis more difficult.
The campaign only needed the recipient to open one attachment. JavaScript and PowerShell then handled the later stages, while the proxy and browser changes gave attackers a way to interfere with banking sessions.
Other H1 2026 activity followed similar patterns. In Italy, fake invoice PDFs, including Booking.com-themed lures, delivered Vercel-hosted scripts, Blogspot-based PowerShell stages and XWorm. Meanwhile, Polish invoice scams used a steganographic .NET loader to install Remcos RAT.
Crypto Clipper Replaced Wallet Addresses
The second of the H1 2026 attack chains focused on cryptocurrency payments. Its final payload was a Rust-based clipboard hijacker that watched copied content for wallet addresses.
The malware supported 21 blockchain types, including Bitcoin, Ethereum and Litecoin. When it detected a supported address, it replaced it with an attacker-controlled alternative.
Victims could follow their usual payment process: copy an address, paste it into a wallet or exchange, then approve the transaction. However, the destination had already changed before the payment was signed.
The blockchain itself was not compromised, and the wallet’s cryptography remained intact. The transaction was valid, but it sent funds to the wrong recipient.
Long wallet addresses are difficult to check visually. Many people only compare the opening and closing characters, which gives attackers an opportunity to use addresses that can pass a quick glance.
Smart Contracts Helped Resolve C2 Infrastructure
The clipper also used Binance Smart Chain as part of its command-and-control setup through EtherHiding. Rather than storing its full backend on-chain, the malware read infrastructure pointers from a smart contract.
Those pointers directed the malware to attacker-controlled domains, URLs or IP addresses.
This approach made simple network indicator lists less useful. A domain can be blocked or replaced, but smart-contract data remains publicly accessible and is harder to remove through regular takedown processes.
Defenders should therefore investigate the contract address, the method used to retrieve its data, the returned information and the infrastructure contacted afterwards as one connected chain.
Detection Must Cover the Entire Workflow
Organisations should correlate suspicious activity after email delivery rather than assessing each event separately. A downloaded attachment launching JavaScript, PowerShell retrieving more files, shellcode execution, proxy changes and a newly installed browser extension may indicate one coordinated attack.
Legitimate sender history should not reduce the priority of suspicious behaviour when a mailbox may have been compromised.
Where appropriate, organisations can restrict script interpreters, apply application-control policies to downloaded attachments and monitor for unexpected browser-extension or proxy-setting changes.
For cryptocurrency threats, defenders should look for clipboard-modifying processes, wallet-address matching and blockchain queries from software that should not make them.
Users should verify the complete destination address on the signing device immediately before approving a cryptocurrency payment. Address books and allowlists can also reduce the risk of manually entering or copying known destinations.
Both campaigns show why trusted emails and familiar payment steps are not enough on their own. Security checks need to cover every stage between the initial message, copied address and final approval.
0 responses to “H1 2026 Attack Chains Use Real Emails and Hijacked Crypto Payments”